From VibeEval
Security research, product notes, and lessons from testing AI-built apps.
In the last 30 days the discussion on X moved from 'should coding agents be sandboxed' to 'which harness, which monitor, which firewall'. Manifold's GitSpawn showed a single .git/config key executes attacker …
Read storyAugust 2026 was the month vibe-coding security stopped being anecdote and became a dataset. Reeve passively scanned 30,998 live vibe-coded apps and found 57% of reachable Supabase backends readable without …
Read storyAn alert is a claim; proof is a reproducible demonstration. Why alert volume is the wrong metric and how gapbench's clean controls make accuracy falsifiable.
Read storyA confirmed npm supply chain compromise in @injectivelabs/sdk-ts (~50,000 weekly downloads) hooks wallet key-derivation and exfiltrates private keys through fake telemetry. VentureBeat puts a name on the …
Read storySophos X-Ops documents a threat actor using Cursor and Claude Opus 4.5 to build an 80-module EDR-evasion framework - the agent as weapon. Days later the Miasma worm plants malicious .claude/, .cursor/, and …
Read storyThe attack class May named went live in June. Sophos caught a threat actor using Cursor and Claude Opus 4.5 to build an 80-module EDR-evasion framework. The Miasma worm planted .claude/, .cursor/, and .gemini/ …
Read storyOX Security puts the number at 62%, one week after Veracode's 45% became canon - and the field admits the number won't settle. The Moltbook breach (1.5M tokens, 35K emails, 72 hours) becomes the reference …
Read storyApple removes the 'Anything' vibe-coding app under Guideline 2.5.2 - the app reappears on Google Play in 30 seconds. Cursor ships its own model, Composer 2. OpenAI reportedly negotiating a ~$3B Windsurf deal. …
Read storyB1KEY's 1,764-app audit independently confirms the RedAccess shape (7% wide-open Supabase, IDOR-by-URL-increment). Cursor announces Bugbot. Mini Shai-Hulud uploads 373 malicious npm versions across 169 …
Read storyMay 2026 update built on a 1,812-event firehose corpus across 7.5 days. 380,000 vibe-coded assets indexed, ~5,000 leaking sensitive data. 45% of AI-generated code fails OWASP Top 10. 91.5% of Q1 2026 vibe-coded …
Read storyRedAccess scanned 380,000 vibe-coded apps and found ~5,000 leaking corporate data. WIRED and Axios verified. Plus TrustFall (AI coding agents as supply-chain vector), OpenClaw / CLI-Anything (agent integration …
Read storyMay 2026 was the month vibe-coding security defenders started shipping. Replit launched Security Agent + Workspace Security Center 2.0. Vercel open-sourced Deepsec. CodeCut published Bandit playbooks for …
Read story